-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.jenkins-ci.plugins:crowd2 | maven | <= 2.0.0 | 2.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from plaintext credential storage in configuration files. The commit 580be2a shows critical changes where password fields were converted from String to Jenkins' Secret type in both classes. The constructors in these files previously accepted and stored credentials as plain strings (evident from the parameter type changes from String to Secret and the added deprecated constructor in CrowdSecurityRealm that converts legacy plaintext inputs). These functions directly handled sensitive credentials without encryption before the patch, making them the vulnerability sources.